who have you seen that is able to access it without CORS errors? i have seen people connect using a server or a framework like svelte or next.js with server-side capabilities but most bots run on servers (not from web clients) or on replit so they would be exempt from CORS rules. my suggestion would be to use Firebase Functions though.